CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Silver Fox APT expands ABCDoor backdoor operations with RustSL loader and tax-themed phishing targeting India, Russia, and additional regions

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

The China-based advanced persistent threat (APT) group Silver Fox conducted phishing campaigns in late 2025 and early 2026 targeting organizations in India and Russia using tax-themed lures to deliver a new Rust-based loader named RustSL, which deploys the ValleyRAT backdoor and a previously undocumented Python-based backdoor called ABCDoor. The operation impacted industrial, consulting, retail, and transportation sectors, with over 1,600 phishing emails observed between January and February 2026. The campaign leveraged phishing emails mimicking tax audit notices or tax violation lists, distributing ZIP/RAR archives from domains such as abc.haijing88[.]com that contained modified open-source RustSL loaders. The backdoor ABCDoor, first deployed in February 2025, enables multi-stage persistence, data collection, remote control, and exfiltration via HTTPS C2 communication. Notable technical features include geofencing checks, sandbox evasion, and a persistence mechanism called Phantom Persistence, which intercepts system shutdown to force a malicious reboot. The group’s targeting has expanded from China to Taiwan, Japan, India, Russia, Indonesia, South Africa, and Cambodia.

Timeline

  1. 04.05.2026 14:57 1 articles · 2h ago

    Silver Fox deploys ABCDoor backdoor via RustSL loader in tax-themed phishing campaigns targeting India and Russia

    In December 2025 and early 2026, Silver Fox conducted phishing campaigns using tax-themed lures to deliver RustSL loaders that deploy ValleyRAT and ABCDoor backdoors. The campaign targeted industrial, consulting, retail, and transportation sectors in India and Russia, with over 1,600 emails observed between January–February 2026. Attack chains involved ZIP/RAR archives hosted on abc.haijing88[.]com containing RustSL variants that perform geofencing and sandbox evasion, with Phantom Persistence enabling stealthy reboot-based execution.

    Show sources
    Open in new tab

Information Snippets